CVE-2026-103530— decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
Quick assessment
Affected
decolua 9Router
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 decolua 9Router（版本 ≤ 0.5.55）中检测到一个漏洞。受影响的是 Search Endpoint 组件中 文件的 函数。攻击者通过操纵参数 ，可触发服务器端请求伪造（SSRF）。该攻击可远程发起。建议应用补丁以修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103530
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provider_options.baseUrl results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action to fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-103530
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103530
请登录查看更多情报信息。
Other References for CVE-2026-103530 (5)
-
-
https://github.com/decolua/9router/issues/3714 issue-tracking
-
https://vuldb.com/cve/CVE-2026-103530 third-party-advisory
-
-
https://vuldb.com/submit/956865 third-party-advisory
IV. Related Vulnerabilities
Same product: 9Router
-
CVE-2026-56682
9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r -
CVE-2026-56681
9Router: Authentication Bypass in Public LLM API via Spoofab -
CVE-2026-72860
9router Server-Side Request Forgery via /api/provider-nodes/ -
CVE-2026-56677
9Router: Authenticated Server-Side Request Forgery (SSRF) vi -
CVE-2026-63313
9Router before 0.4.72 Server-Side Request Forgery via /v1/we
Same vendor: decolua
-
CVE-2026-56682
9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r -
CVE-2026-56681
9Router: Authentication Bypass in Public LLM API via Spoofab -
CVE-2026-72860
9router Server-Side Request Forgery via /api/provider-nodes/ -
CVE-2026-56677
9Router: Authenticated Server-Side Request Forgery (SSRF) vi -
CVE-2026-63313
9Router before 0.4.72 Server-Side Request Forgery via /v1/we
Same weakness: CWE-918
-
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forge -
CVE-2023-54402
iDocView SSRF via /doc/upload Endpoint Hardcoded Token -
CVE-2026-102104
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102103
Kiteworks Email Protection Gateway server-side request forge -
CVE-2026-102102
Kiteworks Email Protection Gateway server-side request forge
V. Comments for CVE-2026-103530
No comments yet